mjhjmtu

What is the difference between /sys/bus/usb/devices/usbX/authorized_default and /sys/bus/usb/devices/usbX/interface_authorized_default? Basically, both of the files are responsible for denying access to newly connected devices to USB ports as described here. They seem to work in the same way, so what's the difference? Which one should I use?

The difference is that the new interface authorization allows to enable or disable individual interfaces per bitmask instead allow or deny a whole device. It's mentioned in the document you linked to:

Interface authorization

..........................

There is a similar approach to allow or deny specific USB interfaces.

That allows to block only a subset of an USB device.

..........................

Deny interfaces per default:

echo 0 > /sys/bus/usb/devices/usbX/interface_authorized_default

Authorize an interface:

echo 1 > /sys/bus/usb/devices/INTERFACE/authorized

This is useful when e.g. you need to debug devices & drivers (no matching driver found or wrong driver/configuration used and so on...), per feature/functionality lockdown of USB devices etc

In a nutshell:

• 
  

  use authorized_default to deny or limit the number of allowed devices
  
  e.g. deauthorize new devices connected to hostX by default

  
  
  

  echo 0 > /sys/bus/usb/devices/usbX/authorized_default
  

  
  
  

  then connect and authorize the device of your choice:

  
  
  

  echo 1 > /sys/bus/usb/devices/DEVICE/authorized
  

  
  


• 
  

  use interface_authorized_default if you need to debug or allow/use only a subset of functionality e.g. deny interfaces on hostX by default:

  
  
  

  echo 0 > /sys/bus/usb/devices/usbX/interface_authorized_default:
  

  
  
  

  authorize the interface of your choice:

  
  
  

  echo 1 > /sys/bus/usb/devices/INTERFACE/authorized
  

  
  
  

  and trigger driver probing:

  
  
  

  echo INTERFACE > /sys/bus/usb/drivers_probe